chevere/http
chevere/http 0.8.0 appears generally suitable to depend on: it is actively maintained, not deprecated or archived, has a directly matching repository with organization backing, clear licensing, repository tests, build tooling, security scanning, and no observed dangerous workflow patterns. The main concerns are its pre-1.0 status, modest release cadence, very small user base, complete concentration of recent commits in one contributor, and missing repository security policy and explicit workflow token permissions. These reduce resilience and transparency but do not indicate abandonment or make the release unfit on the available evidence.
78%
Total Score
90
50
83
80
Health Score Breakdown
The package declares 11 runtime dependencies, including several related Chevere components and standard PSR interfaces; this is a meaningful dependency surface but is coherent for an HTTP framework library.
The package has existed for 1,187 days with 11 releases and 3 releases in the last 12 months, but the median interval is about 92 days, indicating moderate rather than highly active release maintenance.
One contributor made all 9 commits in the last 3 months, creating a low bus factor; organization ownership partially compensates because maintenance can potentially be handed off.
The repository has only 1 star and no forks or watchers, so external adoption and community validation are limited; popularity is supporting evidence rather than decisive evidence.
The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Rodolfo Berrios |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 nyholm/psr7 Version ^1.8.0 | — | — |
chevere/action Version ^3.0.0 | — | — |
chevere/writer Version ^1.0.0 | — | — |
chevere/message Version ^1.0.0 | — | — |
psr/http-factory Version ^1 | — | — |
Weekly Downloads
Info
- Last Published
- 14 days ago
- Created
- 3 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.